CVE-2026-111079

Goose: goose: shell history and environment leak via terminal integration

CVSS 3.1 7.4 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-111079

Published

A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it verbatim without sanitization to configured Large Language Model (LLM) provider endpoints during queries. If a user enters sensitive data—such as API tokens, passwords, or environment variables containing secrets—in the terminal, this unredacted information is transmitted across trust boundaries. This can lead to sensitive information disclosure, exposing confidential credentials to external service providers and logs.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-111079

Published

goose

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 10",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "goose",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "0:1.45.0-2.el10_2",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/o:redhat:enterprise_linux:10.2"
                    ]
                }

goose

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Enterprise Linux 9",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "goose",
                    "defaultStatus": "affected",
                    "versions": [
                        {
                            "version": "0:1.45.0-2.el9_8",
                            "lessThan": "*",
                            "versionType": "rpm",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:/a:redhat:enterprise_linux:9::extensions"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON